Operations management apparatus, operations management system, data processing method, and operations management program

ABSTRACT

An operations management apparatus which acquires performance information for each of a plurality of performance items from a plurality of controlled units and manages operation of the controlled units includes a correlation model generation unit which derives a correlation function between a first series of performance information that indicates time series variation about a first element and a second series of performance information that indicates time series variation about a second element, generates a correlation model between the first element and the second element based on the correlation function, and obtains the correlation model for each element pair of the performance information, and a correlation change analysis unit which analyzes a change in the correlation model based on the performance information acquired newly which has not been used for generation of the correlation model.

This application is based upon and claims the benefit of priority fromJapanese patent application No. 2008-043046, filed on Feb. 25, 2008, thedisclosure of which is incorporated herein in its entirety by reference.

TECHNICAL FILED

The present invention relates to an operations management apparatus, anoperations management system, a data processing method and an operationsmanagement program, and in particular, relates to an operationsmanagement apparatus which correctly detects and localizes performancedeterioration of a system providing an information and communicationsservice.

BACKGROUND ART

In relatively large scale systems such as a business information systemand an IDC (Internet Data Center) system, as the importance of aninformation and communications service such as a web service and abusiness service as a social infrastructure rises, stable operation ofan apparatus (e.g. a server) providing such services is important.Operations management of such an apparatus has been performed by anadministrator manually. As an apparatus becomes more complicated andlarge-scaled, burden on an administrator associated with knowledge andoperation increases by leaps and bounds, causing a situation such asservice suspension triggered by an error in judgment and by an operationmistake.

In order to handle such a situation, an integrated operations managementsystem which monitors and controls hardware or software included in asystem unitarily is provided.

This integrated operations management system acquires information aboutan operation status of a plurality of hardware or of software which isan administration object on-line, and outputs it to a operationmanagement apparatus which is connected to the integrated operationsmanagement system. A method to distinguish a failure of a system beingan administration object includes a method to set a threshold value toperformance information in advance and a method to evaluate a differencefrom a mean value. When it is determined that there is a failure, thelocation of the failure is reported.

For example, in an operations management apparatus of such an integratedoperations management system, a failure is detected by setting athreshold value for each performance information item and detecting eachperformance information item exceeding the threshold value. Theoperations management apparatus sets a value which is consideredundeniably abnormal as the threshold value in advance, and detectsabnormality of each element of performance information.

When the location of the failure has been reported, narrowing down itscause such as whether it is caused by a lack of a memory capacity, anexcessive CPU load, an excessive network load or the like is needed fora failure solution. Because clarification of the cause generallyrequires an examination of system log or a parameter of a computer whichmight be related to the failure as well as system engineer's experienceand sense, time and energy is needed.

For this reason, in an integrated operations management system, it isimportant to perform handling support by performing an analysis of suchas combination of an abnormal states automatically based on event data(state notification) collected from a plurality of equipment, and bypresuming a problem and a cause broadly to notify an administrator.

In particular, in order to ensure reliability during long term continualpractical use of a service, it is required to detect not onlyabnormality which has occurred but also a state such as of performancedeterioration which is not showing clear abnormality currently or of asign of a failure expected to occur in the future, and to performdeliberate equipment reinforcement.

A technology in relation to such integrated operations management systemincludes the followings, for example.

An operations management apparatus of Japanese Patent ApplicationLaid-Open No. 2006-024017 identifies an amount of a load caused byspecific processing by comparing the history of the processing of asystem element and the history of a change in performance information,and analyzes a load for an amount of the processing in the future. Thisoperations management apparatus can identify behavior of a system when arelation between processing and a load can be figured out in advance.

An operations management system of Japanese Patent Application Laid-OpenNo. 2002-342182 identifies a component which is a cause of a failure byquantifying a magnitude of relation between components of a system basedon operation information. This operations management apparatusenumerates candidates of the cause for an element which has becomeabnormal by weighting and displaying elements which have a correlationwith the performance value as of that moment as a list.

That is, an operations management system of Japanese Patent ApplicationLaid-Open No. 2002-342182 includes a managed system, a network and anoperations management server. Operation information on each componentcollected via an operation information collection adapter from themanaged system is stored in an operation information storage unit of anoperations management server. In an analysis arithmetic processor of anoperations management server, one arbitrary operation information itemor one operation information item which has exceeded the range of avalue set in advance is selected, and magnitude of relation with otheroperation information items besides that item is quantified. In case ofcalculation of quantification, an analysis arithmetic processor extractsoperation information which is needed from an operation informationcollection unit sequentially. When a quantified value of relation of anoperation information item among the target operation information itemsof the calculation exceeds the range of the value set in advance, theanalysis arithmetic processor determines that the operation informationitem has a high possibility to be a cause of a bottleneck of performanceor a failure, and reports it to an input/output unit of an operationsmanagement server.

In an operations management apparatus of Japanese Patent ApplicationLaid-Open No. 2006-146668, an operation information collection unitacquires hardware operation information of such as a CPU, a Network IO(network Input/Output) and the like and application operationinformation of such as access volume of a Web server and a processingquery amount of a DB server from a plurality of apparatus in a systemwhich is the target of monitoring at regular time intervals using ICMP,SNMP and rsh, and stores it in operation information DB. Apre-processing unit performs statistical processing which obtains astatistical analytical value between operation information on eachconstituent element stored in operation information DB. Thepre-processing unit finds a statistical analytical value by obtainingthe coefficient of correlation between individual operation informationor by performing main component analysis between individual operationinformation, for example. This statistical analytical value indicatesthe degree of association between operation information on eachapparatus in a given time. For example, in FIG. 2 of Japanese PatentApplication Laid-Open No. 2006-146668, the coefficient of correlation ofthe CPU utilization rate of server 1 and the CPU utilization rate ofserver 2 is 0.93. A coefficient of correlation represents the degree ofthe correlation between two variables. First, this operations managementapparatus periodically acquires hardware operation information such as aCPU utilization rate from a server and a network device and the likewhich are monitoring targets and, in the case of a Web server,application level information such as access situations, and thencalculates “the relation between acquired values” which characterizeseach situation using a statistical method such as a correlative analysisand main component analysis from operation information in each situationsuch as of the time of normal access and of the time of a failure, anddefines a model of each situation and hold it in model information DB.Next, at the time of operation, calculation is performed for the currentoperation information using the same statistical method as the modelswhich have been defined periodically or occasionally triggered by analert of a failure or by a decline of response of a provided service,and the result thereof is compared with the defined models stored inmodel information DB to identify the situation of a corresponding modelas the situation at present.

In an operations management apparatus of Japanese Patent ApplicationLaid-Open No. 2007-207117, a monitor unit acquires status informationrelated to a state of AC environment and non-AC environment. An analysisunit or a model diagnosis unit judges a state of an apparatus in ACenvironment based on acquired status information. A simulation unitrefers to a countermeasure list corresponding to the judgment result,carries out simulation processing by a countermeasure included in thecountermeasure list and evaluates the effect of the each countermeasure.A model extraction unit plots monitoring data of at times 1-3 in acoordinate system representing relation of the usage rate of a CPU totime, and extracts a model which expresses a time series change of theCPU usage rate by obtaining a linear approximation equation (fa(x)=αx+β)for each monitoring data plotted. A model extraction unit accumulatesthe extracted model in a knowledge information accumulation unit.Similarly, the model extraction unit obtains a model also in acoordinate system representing relation of the throughput to time. Themodel extraction unit obtains linear approximation equations(fTA(x)=ρ1x+θ1 and fTB(x)=ρ2x+θ2) representing correlation between theCPU utilization rate and the throughput for each of processing A andprocessing B using a correlative analysis and a multivariate analysis tothese two models, and extracts a model which indicates a correlationbetween the CPU utilization rate and the throughput. A model diagnosisunit refers to a policy corresponding to each model respectively andperforms diagnosis (paragraph numbers 0060-0062 of Japanese PatentApplication Laid-Open No. 2007-207117).

In Published Japanese translation of PCT application No. 2005-524886bulletin, a collector is started based on a type of a workload duringoperation on the computer, and a threshold value for a metrics is setbased on the workload. Next, it is determined when the metrics exceedsthe threshold value (according to both of the present workload and anpredicted workload), and a correlation between each metrics is obtainedto judge whether the hardware capacity is the cause of the problem.

SUMMARY

An exemplary object of the invention is to provide an operationsmanagement apparatus, an operations management system, a data processingmethod and an operations management program capable of detecting a signof a failure and of identifying an occurring place.

An operations management apparatus which acquires performanceinformation for each of a plurality of performance items from aplurality of controlled units and manages operation of the controlledunit according to an exemplary aspect of the invention includes acorrelation model generation unit which derives, when the performanceitems or the controlled units are designated as an element ofperformance information, a correlation function between a first seriesof performance information that indicates time series variation about afirst element and a second series of performance information thatindicates time series variation about a second element, generates acorrelation model between the first element and the second element basedon the correlation function, and obtains the correlation model for eachelement pair of the performance information, and a correlation changeanalysis unit which analyzes a change in the correlation model based onthe performance information acquired newly which has not been used forgeneration of the correlation model.

The operations management system according to an exemplary aspect of theinvention includes a plurality of controlled units, and an operationsmanagement apparatus which acquires performance information for each ofa plurality of performance items from the plurality of controlled unitsand manages operation of the controlled units, wherein the operationsmanagement apparatus including a correlation model generation unit whichderives, when the performance items or the controlled units aredesignated as an element of performance information, a correlationfunction between a first series of performance information thatindicates time series variation about a first element and a secondseries of performance information that indicates time series variationabout a second element, generates a correlation model between the firstelement and the second element based on the correlation function, andobtains the correlation model for each element pair of the performanceinformation, and a correlation change analysis unit which analyzes achange in the correlation model based on the performance informationacquired newly which has not been used for generation of the correlationmodel.

A data processing method of an operations management apparatus whichacquires performance information for each of a plurality of performanceitems from a plurality of controlled units and manages operation of thecontrolled units according to an exemplary aspect of the inventionincludes obtaining a correlation model for each element pair ofperformance information by deriving, when the performance items or thecontrolled units are designated as an element of the performanceinformation, a correlation function between a first series ofperformance information that indicates time series variation about afirst element and a second series of performance information thatindicates time series variation about a second element, and generatingthe correlation model between the first element and the second elementbased on the correlation function, and analyzing a change in thecorrelation model based on the performance information acquired newlywhich has not been used for generation of the correlation model.

A computer readable medium embodying program, the program causing anoperations management apparatus which acquires performance informationfor each of a plurality of performance items from a plurality ofcontrolled units and manages operation of the controlled units toperform a method, according to an exemplary aspect of the inventionincludes obtaining a correlation model for each element pair ofperformance information by deriving, when the performance items or thecontrolled units are designated as an element of the performanceinformation, a correlation function between a first series ofperformance information that indicates time series variation about afirst element and a second series of performance information thatindicates time series variation about a second element, and generatingthe correlation model between the first element and the second elementbased on the correlation function, and analyzing a change in thecorrelation model based on the performance information acquired newlywhich has not been used for generation of the correlation model.

An operations management apparatus which acquires performanceinformation for each of a plurality of performance items from aplurality of controlled units and manages operation of the controlledunits according to an exemplary aspect of the invention includes acorrelation model generation means for deriving, when the performanceitems or the controlled units are designated as an element ofperformance information, a correlation function between a first seriesof performance information that indicates time series variation about afirst element and a second series of performance information thatindicates time series variation about a second element, generating acorrelation model between the first element and the second element basedon the correlation function, and obtaining the correlation model foreach element pair of the performance information, and a correlationchange analysis means for analyzing a change in the correlation modelbased on the performance information acquired newly which has not beenused for generation of the correlation model.

A data processing method of an operations management apparatus whichacquires performance information for each of a plurality of performanceitems from a plurality of controlled units and manages operation of thecontrolled units according to an exemplary aspect of the inventionincludes a step for obtaining a correlation model for each element pairof performance information by deriving, when the performance items orthe controlled units are designated as an element of the performanceinformation, a correlation function between a first series ofperformance information that indicates time series variation about afirst element and a second series of performance information thatindicates time series variation about a second element, and generatingthe correlation model between the first element and the second elementbased on the correlation function, and a step for analyzing a change inthe correlation model based on the performance information acquirednewly which has not been used for generation of the correlation model.

BRIEF DESCRIPTION OF THE DRAWINGS

Exemplary features and advantages of the present invention will becomeapparent from the following detailed description when taken with theaccompanying drawings in which:

FIG. 1 is an exemplary block diagram of the entire structure of anoperations management system including an operations managementapparatus of a first exemplary embodiment.

FIG. 2 is an exemplary block diagram of a configuration which is thepremise of an operations management apparatus of the first exemplaryembodiment.

FIG. 3 is an exemplary diagram of performance information used in anoperations management apparatus of the first exemplary embodiment.

FIG. 4 is an exemplary block diagram of the entire structure of anoperations management apparatus of the first exemplary embodiment.

FIG. 5 is another exemplary block diagram of the entire structure of anoperations management apparatus of the first exemplary embodiment.

FIG. 6 is an exemplary diagram of transform function identification inan operations management apparatus of the first exemplary embodiment.

FIG. 7 is an exemplary diagram of a data structure of a correlationmodel in an operations management apparatus of the first exemplaryembodiment.

FIG. 8 is an exemplary diagram of another data structure of acorrelation model in an operations management apparatus of the firstexemplary embodiment.

FIG. 9 is an exemplary diagram of a correlation model selection in anoperations management apparatus of the first exemplary embodiment.

FIG. 10 is an exemplary diagram of correlation change detection in anoperations management apparatus of the first exemplary embodiment.

FIG. 11 is an exemplary flowchart showing an example of the overallprocessing procedure in an operations management apparatus of the firstexemplary embodiment.

FIG. 12 is an exemplary flowchart of a detailed processing procedure ofcorrelation model generation in an operations management apparatus ofthe first exemplary embodiment.

FIG. 13 is an exemplary flowchart of the detailed processing procedureof correlation change analysis in an operations management apparatus ofthe first exemplary embodiment.

FIG. 14 is an exemplary diagram of an indicated display screen in anoperations management apparatus of the first exemplary embodiment.

FIG. 15 is an exemplary block diagram of the entire structure of anoperations management apparatus of a second exemplary embodiment.

FIG. 16 is another exemplary block diagram of the entire structure of anoperations management apparatus of the second exemplary embodiment.

FIG. 17 is an exemplary diagram of correlation model disabling in anoperations management apparatus of the second exemplary embodiment.

FIG. 18 is an exemplary diagram of a data structure of a correlationmodel in an operations management apparatus of the second exemplaryembodiment.

FIG. 19 is an exemplary flowchart of the overall processing procedure inan operations management apparatus of the second exemplary embodiment.

FIG. 20 is an exemplary flowchart of a detailed processing procedure ofsteady change analysis in an operations management apparatus of thesecond exemplary embodiment.

FIG. 21 is an exemplary diagram of an indicated display screen in anoperations management apparatus of the second exemplary embodiment.

EXEMPLARY EMBODIMENT Basic Configuration of Operations ManagementApparatus

First, the basic configuration of an operations management apparatuswill be described. An operations management apparatus (symbol 100 shownin FIG. 4, for example) of the exemplary embodiment acquires performanceinformation for each of a plurality of performance items from aplurality of controlled units of a system and manages the operation ofthe controlled units.

This operations management apparatus includes: a correlation modelgeneration unit (symbol 123 shown in FIG. 4, for example) derives, whenabove-mentioned performance items or the controlled units are designatedas an element of performance information, a correlation function betweena first series of performance information that indicates time seriesvariation about a first element and a second series of performanceinformation that indicates time series variation about a second element,generates a correlation model between the first element and the secondelement based on the correlation function, and obtains the correlationmodel for each element pair of the performance information, and acorrelation change analysis unit (symbol 124 shown in FIG. 4, forexample) which analyzes a change in the correlation model based on theperformance information acquired newly which has not been used forgeneration of the correlation model.

In such an operations management apparatus, correlation model generationunit generates a correlation model by deriving a correlation functionfor time series information of two elements of performance information(a series of performance information). When new performance informationwhich has not been used for generation of a correlation model isacquired, the correlation change analysis unit analyzes whether theperformance information acquired newly is performance informationconforming to a correlation function of a correlation model which hasbeen already generated, that is, whether there is a change or not in thecorrelations in the correlation model (whether a correlation is kept orcollapsed).

As a result, the operations management apparatus can specify theoccurring place of an abnormality (an element with abnormality)according to whether a correlation generated at the time of normaloperation is deformed or not. An operations management apparatus candetect performance abnormality such as response degradation and a signof a failure correctly and specify an occurring place by modeling acorrelation of detected performance information, and monitoring a changeof the model.

Hereinafter, an exemplary embodiment in which such an operationsmanagement apparatus is applied to an operations management system willbe described.

First Exemplary Embodiment Entire Structure of Operations ManagementSystem

First, regarding the concrete configuration of an operations managementsystem of a first exemplary embodiment, the entire structure isdescribed, followed by a description of the detailed structure of eachpart.

FIG. 1 is an exemplary block diagram of the entire structure of anoperations management system including an operations managementapparatus of the first exemplary embodiment.

As shown in FIG. 1, operations management system 1 of the firstexemplary embodiment includes computers 2 which are a plurality ofcontrolled units, operations management apparatus 3 which is capable ofcommunicating with computers 2 via network N, and manages the operationof computers 2.

Operations management apparatus 3 acquires performance information foreach of a plurality of performance items (a CPU utilization factor andremaining memory capacity, for example) from the plurality of computers2.

Computer 2 and operations management apparatus 3 may be any computer ifit is operated by program control and includes a network relatedfunction, such as a desktop computer, a laptop computer, a server, orsome other information devices having wireless or wired communicationfunctions or a computer similar to this. Computer 2 and operationsmanagement apparatus 3 may be of a portable type or a stationary type.

The hardware configuration of operations management apparatus 3 includesa display unit (screen) indicating various information or the like, anoperation input unit (such as a keyboard and a mouse, for example)performing operational input of data on the display screen of thedisplay unit (such as on various input columns), a transmission andreception unit (a communication unit) sending and receiving varioussignals and data, a memory unit (such as a memory and a hard disk, forexample) storing various programs and various data, a control unit (suchas CPU, for example) which controls these units, and the like.

Computer 2 also may be a network device or other equipment, or amainframe.

(Premised Configuration)

Here, the configuration of an operations management apparatus which is apremise of the first exemplary embodiment will be described referring toFIG. 2 and FIG. 3 before describing the characteristic configuration ofthe first exemplary embodiment.

FIG. 2 is an exemplary block diagram of a configuration which is thepremise of an operations management apparatus of the first exemplaryembodiment. Referring to FIG. 2, operations management apparatus 3 whichindicates the configuration which is the premise of the first exemplaryembodiment includes service executor 21, performance information storageprocessing unit 12, information collection unit 22, analysis settingstorage processing unit 14, failure analysis unit 26, administratordialogue unit 27 and handling executing unit 28.

Service executor 21 provides an information and communications servicesuch as a web service and a business service. Service executor 21 may beon another independent computer or the like.

Performance information storage processing unit 12 accumulates eachelement of performance information of service executor 21.

Information collection unit 22 detects an operation state of serviceexecutor 21 and accumulates in performance information storageprocessing unit 12 performance information included in the operationstate.

Analysis setting storage processing unit 14 accumulates an analysissetting to detect abnormality of service executor 21.

Failure analysis unit 26 receives an operation state from informationcollection unit 22 and performs failure analysis according to theanalysis setting of analysis setting storage processing unit 14.

Administrator dialogue unit 27 receives a result of the failure analysisfrom failure analysis unit 26 and presents it to an administrator.Administrator dialogue unit 27 accepts administrator's input andinstructs handling executing unit 28 to handle a failure according toadministrator's input.

Handling executing unit 28 carries out processing which is handling forthe failure on service executor 21 according to the instruction ofadministrator dialogue unit 27.

FIG. 3 is an exemplary diagram of performance information used by anoperations management apparatus of the first exemplary embodiment. FIG.3 shows performance information outputted by information collection unit22 and accumulated in performance information storage processing unit12. Each line of performance information 12 a includes values for eachperformance item (element) at the same point of time, and the values arelisted at regular time intervals.

Operation of operations management apparatus 3 having the premisedconfiguration mentioned above will be described using FIG. 2 and FIG. 3.

First, information collection unit 22 of FIG. 2 detects an operationstate of service executor 21 and accumulates performance information inperformance information storage processing unit 12. For example, when aweb service is carried out by service executor 21, informationcollection unit 22 detects CPU utilization rate and remaining memorycapacity of each server which provides the web service at regular timeintervals.

Performance information 12 a of FIG. 3 is an example of the detectedperformance information. For example, SV1-CPU indicates a value of a CPUutilization factor of one server, and the value at time 17:25 of Oct. 5,2007 is 12. The values of 15, 34 and 63 are detected at one minuteintervals from 17:26. Similarly, SV1-MEM is the value of the remainingmemory capacity of the same server and SV2-CPU is the value of the CPUutilization factor of a different server detected at the same time ofday.

Next, failure analysis unit 26 performs a failure analysis according toa analysis setting accumulated in analysis setting storage processingunit 14. As an analysis setting, a detection condition of a failure isdesignated such as when the CPU utilization factor exceeds a certainvalue, a warning message is presented to an administrator, for example.Failure analysis unit 26 determines whether a load of a specific serverhas become high or not from the value of the performance informationdetected by information collection unit 22 using a threshold valueaccording to an analysis setting.

Administrator dialogue unit 27 presents a result of such failureanalysis to an administrator. When an administrator performs an inputoperation which directs administrator dialogue unit 27 to perform somehandling for the result of the failure analysis, administrator dialogueunit 27 carries out a handling command on service executor 21 viahandling executing unit 28.

For example, when knowing that a CPU load has become high, theadministrator reduces the amount of services or performs a configurationchange for load sharing.

When a value of the performance information collected by informationcollection unit 22 at regular time intervals decreases after this,failure analysis unit 26 determines that the failure has been recoveredand shows the result to the administrator via administrator dialogueunit 27. By a repeat of processing of such an information collection,analysis and handling, failure handling for service executor 21continues to be performed.

In addition to such premised configuration, the present exemplaryembodiment has a characteristic configuration indicated below.

(Characteristic Composition of the First Exemplary Embodiment)

Here, the characteristic configuration of an operations managementapparatus of the first exemplary embodiment will be described withreference to FIG. 4. FIG. 4 is an exemplary block diagram of the entirestructure of an operations management apparatus of the first exemplaryembodiment.

As shown in FIG. 4, operations management apparatus 100 of the firstexemplary embodiment is configured including correlation modelgeneration unit 123, correlation model information storage processingunit 116 and correlation change analysis unit 124 in addition to serviceexecutor 121, performance information storage processing unit 112,information collection unit 122, analysis setting storage processingunit 114, failure analysis unit 126, administrator dialogue unit 127 andhandling executing unit 128 which are the same compositions asoperations management apparatus 3 shown in FIG. 2.

Correlation model generation unit 123 takes out performance informationfor a certain period from performance information storage processingunit 112, and derives, for time series of two discretionary elements ofthe performance information, a transform function when making oneelement as input and making the other as output. Then, correlation modelgeneration unit 123 compares a series of values of the element generatedby this transform function and a series of an actual detected value, andcalculates the weight of the transform function from the differencebetween those values. By repeating these processing for all elementpairs, correlation model generation unit 123 generates a correlationmodel of the overall operating state of service executor 121.

Correlation model information storage processing unit 116 accumulatesthe correlation model generated by correlation model generation unit123.

Correlation change analysis unit 124 receives performance informationacquired newly which has not been used for generation of a correlationmodel from information collection unit 122. Correlation change analysisunit 124 analyzes whether a value of an element included in theperformance information acquired newly satisfies a relationshipindicated by a transform function between each element of a correlationmodel accumulated in correlation model information storage processingunit 116 within a predetermined error range. Correlation change analysisunit 124 outputs the result.

Failure analysis unit 126 receives the result of the analysis ofcorrelation change analysis unit 124 and performs a failure analysis aswell as other analyses such as a threshold determination.

FIG. 5 is another exemplary block diagram of the entire structure of theoperations management apparatus of the first exemplary embodiment. Asshown in FIG. 5, each unit of operations management apparatus 100 mayinclude a plurality of functions of a control unit.

Correlation change analysis unit 124 may calculate a predicted value ofthe second element based on the first element of the performanceinformation acquired newly which has not been used for generation of thecorrelation model and the correlation function, calculate a predictionerror by comparing a value of the second element of the performanceinformation acquired newly which has not been used for generation of thecorrelation model with the predicted value of the second element, andanalyze whether the prediction error is in a predetermined error range.

Correlation change analysis unit 124 also may determine that acorrelation between the first element and the second element isdestroyed, when the prediction error is out of the error range, andcalculate an abnormal score of the first element and the second element.

Further, correlation change analysis unit 124 may performs control toindicate each of the elements being sequenced based on the abnormalscore.

(Correlation Model Generation)

Here, the outline of correlation model generation by correlation modelgeneration unit 123 will be described with reference to FIG. 6. FIG. 6is an exemplary diagram of transform function identification in anoperations management apparatus of the first exemplary embodiment.

Generation of a correlation function can be performed by processing ofStep S103 (a correlation function generation function) shown in FIG. 12to generate a correlation function (transform function) and Step S104 (aweight calculation function) to calculate an error.

As shown in FIG. 6, transform function G300 takes a series of the valuesof SV1-CPU indicated in graph G101 (a first series of performanceinformation) as input, and outputs a series of the values of SV1-MEMindicated in graph G102 (a second series of performance information).

Correlation model generation unit 123 calculates this transform functionG300 by system identification processing G301.

For example, correlation model generation unit 123 calculates A=−0.6 andB=100 for a transform function indicated by a formula of y=Ax+B.

As indicated in graph G302, correlation model generation unit 123generates a weight w from a difference between the series of predictedvalues of an element of performance information generated from graphG101 using this transform function and a series of values of the elementof performance information detected actually as indicated in graph G102.

Here, weight w may be defined as value 0-1 representing the magnitude ofa difference (prediction error) between a series of values of an elementpredicted by this transform function and a series of values detectedactually, for example. In this case, the larger the difference(prediction error) is, the smaller weight w is, and the smaller thedifference (prediction error) is the larger weight w is. In this case,weight w may be a value corresponding to a percentage of a predictedvalue which is matched with a detected value, and it may be 1 when aseries of predicted values and a series of detected values are identicalcompletely, and 0 when they are not identical at all. Alternatively,weight w may be a value which includes the degree of a difference when apredicted value is not identical with a detected value.

FIG. 7 is an exemplary diagram of a data structure of a correlationmodel in an operations management apparatus of the first exemplaryembodiment. Correlation model 116 a includes the name of an element ofperformance information which is assigned as input of a transformfunction, the name of an element of performance information assigned asoutput of a transform function, a value of each coefficient thatspecifies a transform function, a weight and correlation determinationinformation which indicates whether a correlation is effective orinvalid. For example, when the transform function is y=Ax+B as shown inFIG. 6, the value −0.6 of coefficient A, the value 100 of thecoefficient B and the weight 0.88 are stored for SV1-CPU and SV1-MEM.The correlation is effective, meaning that a correlation has not beendestroyed and is kept.

(Correlation Change Analysis)

The outline of correlation change analysis by correlation changeanalysis unit 124 will be described with reference to FIG. 9. FIG. 9 isan exemplary diagram of correlation model selection in an operationsmanagement apparatus of the first exemplary embodiment.

Correlation graph G310 in FIG. 9 is an example of correlation models incorrelation model information storage processing unit 116. In FIG. 9, aCPU utilization rate and remaining memory capacity of three servers SV1,SV2 and SV3 are expressed as elements A-F of performance informationrespectively.

For example, element A, SV1-CPU, means that it is the CPU utilizationrate of the first server. Element D, SV2.MEM, means that it is theremaining memory capacity of the second server.

A line which connects between respective elements indicates acorrelation expressed by a transform function of a correlation model.For a correlation having a weight represented by the range 0-1 of 0.5 ormore, the correlation is indicated by a heavy line, and for acorrelation besides those by a thin line.

For example, a correlation between element A and element B is a heavyline, meaning that the weight of the correlation model is no smallerthan 0.5. A correlation between element A and element F is a thin line,meaning that weight information on the correlation model is less than0.5.

Because the weight is calculated according to an error of a transformfunction, the thickness of these lines represents the strength of thecorrelation. Correlation change analysis unit 124 extracts only stablecorrelations for which a weight is no smaller than 0.5 from correlationgraph G310 and obtains a correlation such as correlation model G311, forexample.

FIG. 10 is an exemplary diagram of correlation change detection in anoperations management apparatus of the first exemplary embodiment. FIG.10 is an explanation drawing showing an example of the state in which acorrelation has been destroyed when performance information is detectednewly in an operations management apparatus according to the exemplaryembodiment. In correlation graph G312 shown in FIG. 10, correlationsbetween element A and element C, and element B and element C amongcorrelations indicated in correlation graph G311 have been destroyed (itis indicated by a dotted line).

(Processing Procedure)

(Overall Processing)

Next, processing of each unit in an operations management apparatusincluding the above-mentioned configurations may be also realizable as amethod, thus various processing procedures as a data processing methodwill be described with reference to FIGS. 11 to 13.

FIG. 11 is an exemplary flowchart showing an example of the overallprocessing procedure in an operations management apparatus of the firstexemplary embodiment.

A data processing method of the exemplary embodiment performsinformation processing to acquire performance information for each of aplurality of performance items from a plurality of controlled units tomanage operation of the controlled unit.

This data processing method may include, as basic configuration,obtaining a correlation model for each element pair of performanceinformation by deriving, when the performance items or the controlledunits are designated as an element of the performance information, acorrelation function between a first series of performance informationthat indicates time series variation about a first element and a secondseries of performance information that indicates time series variationabout a second element, and generating the correlation model between thefirst element and the second element based on the correlation function(Step S11 shown in FIG. 11, for example); and analyzing a change in thecorrelation model based on the performance information acquired newlywhich has not been used for generation of the correlation model (StepS12 shown in FIG. 11, for example).

Hereinafter, detailed processing of the correlation model generation andcorrelation change analysis will be described.

(Detailed Processing of Correlation Model Generation)

FIG. 12 is an exemplary flowchart of the detailed processing procedureof the correlation model generation in an operations managementapparatus of the first exemplary embodiment.

In the detailed processing of the correlation model generation in thefirst exemplary embodiment, first, information collection unit 122collects an operation state of service executor 121 and accumulatesperformance information 12 a shown in FIG. 3 in performance informationstorage processing unit 112.

Correlation model generation unit 123 reads performance information 12 afrom performance information storage processing unit 112 (Step S101shown in FIG. 12).

Next, correlation model generation unit 123 determines presence orabsence of an element of performance information which has not beenanalyzed yet (Step S102).

In a state that a correlation model is not generated, correlation modelgeneration unit 123 moves to processing to calculate a transformfunction between elements of the performance information (Step S103),because there are elements of the performance information which have notbeen analyzed yet.

First, correlation model generation unit 123 calculates a transformfunction between a series of element SV1-CPU and a series of SV1-MEM ofperformance information 12 a. In case of FIG. 6, correlation modelgeneration unit 123 determines transform function G300 where SV1-CPU isset as input x and SV1-MEM as output y following system identificationprocessing G301.

There are several techniques in such system identification. For example,using the formula y=Ax(t)+Bx(t−1)+Cx(t−2)+Dy(t−1)+Ey(t−2)+F, a value ofvariables A-F is determined so that values of time series of ycalculated from x become closest to values of y detected actually.

Hereinafter, in order to simplify a description, a case where A and B ofthe formula y=Ax+B are determined will be described. Even when othersystem identification methods are used, if a transform function that cancalculate from a series of individual performance information of oneelement of performance information a series of individual performanceinformation of another element of performance information is used, thesimilar effect is obtained.

In System identification processing G301 of FIG. 6, y=Ax+B is selectedas a function, and −0.6 and 100 are determined as a value of A and Brespectively which can approximate graph G102 from graph G101 (Step S103shown in FIG. 12).

As shown in graph G302, in system identification processing G301, aseries of predicted values of SV1-MEM calculated using this transformfunction and a series of values of SV1-MEM detected actually (graphG102) are compared. System identification processing G301 thencalculates a weight of the transform function from a difference betweenthem (a conversion error) (Step S104 shown in FIG. 12) <that is, aweight calculation step or a weight calculation function>.

Correlation model generation unit 123 adds the calculated transformfunction and the weight to correlation models of correlation modelinformation storage processing unit 116 (Step S105).

FIG. 7 is an example of a correlation model added in this way. As acorrelation model between element SV1-CPU and SV1-MEM, the values of A,B and W are accumulated.

Subsequently, in the same way, by performing processing of StepsS103-S105 to all combinations of a sequence of each element included inperformance information 12 a, correlation models about currentperformance information of the system are established in correlationmodel storage processing unit 116.

Correlation models 116 b of FIG. 8 is an example of a correlation modelgenerated in this way, and transform functions about SV3-CPU and SV2-CPUare added in addition to items in correlation model 116 a of FIG. 7.

(Detailed Processing of Correlation Change Analysis)

Next, the detailed processing of correlation change analysis in thepresent exemplary embodiment will be described with reference to FIG.13, FIG. 9 and FIG. 10. FIG. 13 is an exemplary flowchart of a detailedprocessing procedure of the correlation change analysis in an operationsmanagement apparatus of the first exemplary embodiment.

First, as shown in FIG. 13, correlation change analysis unit 124 reads acorrelation model from correlation model information storage processingunit 116 (Step S201 shown in FIG. 13) and selects the correlation by theweight included in the correlation model (Step S202).

Correlation graph G310 of FIG. 9 is an example of correlation models incorrelation model information storage processing unit 116. In FIG. 9, aCPU utilization rate and remaining memory capacity of three servers SV1,SV2 and SV3 is expressed as elements A-F of performance informationrespectively.

Lines connecting between the respective elements indicate a correlationexpressed by a transform function of a correlation model. For acorrelation having a weight represented by the range 0-1 of 0.5 or more,the correlation is indicated by a heavy line, and for a correlationbesides those by a thin line.

The thickness of these lines represents the strength of the correlation,because a weight is calculated by an error of a transform function.Correlation change analysis unit 124 extracts only a stable correlationin which the weight is no smaller than 0.5 from correlation graph G310and obtains a correlation like correlation model G311, for example.

In correlation graph G312 shown in FIG. 10, correlations between elementA and element C, and element B and element C among correlationsindicated in correlation graph G311 have been destroyed (it is indicatedby a dotted line).

Next, correlation change analysis unit 124 obtains performanceinformation acquired newly which has not been used for generation of acorrelation model from information collection unit 122 (Step S203).

For example, in performance information 12 a of FIG. 3, when performanceinformation as of Nov. 7, 2007 8:31 shown in the lowest line of the listhas been obtained as new performance information, correlation changeanalysis unit 124 searches transform functions described in correlationmodels 116 b shown in FIG. 8 successively.

That is, correlation change analysis unit 124 performs determinationprocessing of whether there is a correlation model which has not beensearched (Step S204). In this determination processing, when beingdetermined that there is no correlation model which has not beensearched, correlation change analysis unit 124 advances towards StepS208, and outputs details of destroyed correlation.

On the other hand, in this determination processing, when beingdetermined that there is a correlation model which has not beensearched, correlation change analysis unit 124 advances towards StepS205, selects a correlation model among correlation models which havenot been searched; using the value of an element of the performanceinformation acquired newly and the correlation function of thecorrelation model, predicts a value of the other element; and calculatesa prediction error of the other element (Step S205).

For example, correlation change analysis unit 124 calculates thecorrelation function (−0.6)*(20)+100 for the detected value 20 ofSV1-CPU acquired newly, and calculates a predicted value 88 of the otherelement SV1-MEM. Correlation change analysis unit 124 obtains the error9 by comparing the predicted value 88 and the detected value 79 ofelement SV1-MEM.

Next, correlation change analysis unit 124 calculates the proportionthat this prediction error occupies in the detected value. Then,correlation change analysis unit 124 determines whether the predictionerror exceeds a given value determined in advance (whether it is withina predetermined given range) (Step S206).

In this determination processing, when being determined that thisprediction error does not exceed the predetermined value, correlationchange analysis unit 124 returns to Step S204 and repeats processingafter this step.

On the other hand, in this determination processing, when beingdetermined that this prediction error exceeds the predetermined value,correlation change analysis unit 124 advances towards Step S207,calculates an abnormal score of the correlation destruction and returnsto Step S204.

For example, in Step S206, in case a prediction error does not exceedthreshold value of 20% which has been decided in advance, it is deemedthat the correlation is kept, and correlation change analysis unit 124returns to Step S204.

In the same way, when correlation change analysis unit 124 calculates aprediction error between SV1-CPU and SV2-CPU (Step S205), and detectsthat the value exceeds 20% (Step S206), correlation change analysis unit124 determines that there is correlation destruction and calculates anabnormal score of the respective elements (Step S207).

Here, the abnormal score is a value that indicates the degree ofabnormality of an element for which correlation destruction has beendetected. For example, the abnormal score may be defined as, regardingthe number of connections between an element and a correlation for whichrelation has been destroyed, a proportion that the number of connectionsof each element occupies in the number of all connections in thecorrelation model. In this case, an abnormal score can be defined as(the number of connections between an element and a correlation forwhich relation has been destroyed)/(2×the number of destroyedcorrelations).

Henceforth, correlation change analysis unit 124 searches allcorrelations successively (Step S204) and outputs a result of theanalysis including a list of destroyed correlations and an abnormalscore to failure analysis unit 126 (Step S208).

FIG. 10 indicates a state of correlation destruction detected in thisway. In correlation graph G312, correlations between element A andelement C, and element B and element C among correlations indicated incorrelation graph G311 are destroyed (they are indicated by dottedlines).

Failure analysis unit 126 receives such a result and shows it to anadministrator along with a result of other failure analyses.

As a display screen which indicates a result of such correlation changeanalysis, something shown in FIG. 14 may be used, for example. FIG. 14is an exemplary diagram of an indicated display screen in an operationsmanagement apparatus of the first exemplary embodiment. In this diagram,an example of a display screen (correlation change analysis resultscreen) in correlation change analysis is indicated.

As shown in FIG. 14, display screen U100 (correlation change analysisresult screen) shown on a display unit includes a correlation graphdisplay portion U140 which indicates a correlation graph. Correlationgraph display portion U140 may indicate a state and a transfer situationof a correlation graph shown in FIG. 9 and FIG. 10 described above. Inthis example, correlation destruction is indicated by a heavy straightline and an element having a high abnormal score is indicated by acircle with a heavy line.

Display screen U100 further includes abnormal score element list displayportion U120 which lists elements having a high abnormal score in turn.Abnormal score element list display portion U120 may indicate the amountof an abnormal score of an element (performance item) and otherinformation of the element.

Display screen U100 includes analysis result display portion U110 onwhich a correlation change analysis result such as a proportion ofcorrelation destruction in the correlation graph of correlation graphdisplay portion U140 and an element with the largest abnormal scoreamong elements of the abnormal score element list of abnormal scoreelement list display portion U120 are displayed.

Display screen U100 also includes the-number-of-correlation-destructionchange graphic display portion U130 which graphs and indicates an agingchange of the number of correlation destruction.

Display screen U100 includes first display operating portion U152indicating a list of a destroyed correlation. Display screen U100includes second display operating portion U154 indicating detailedinformation on a selected element. Display screen U100 includes thirddisplay operating portion U156 ending displaying of the correlationchange analysis result screen.

In FIG. 14, two correlations related to element C (SV2-CPU) among eightindicated correlations on correlation graph G311 are destroyed, and theproportion of the correlation destruction is 25%. The number ofconnections of elements A (SV1-CPU), B (SV1-MEM) and C with thedestroyed correlations are 1, 1 and 2, respectively, and the sum of thenumber of these connections will be 4. Accordingly, an abnormal score ofelements A, B and C will be 25%, 25% and 50% respectively.

As shown in FIG. 14, analysis result display portion U110 of displayscreen U100 shows that the proportion of the correlation destruction is25% and the element with the largest abnormal score is element C, as aresult of the correlation change analysis. Abnormal score element listdisplay portion U120 of display screen U100 shows that an abnormal scoreof element C, SV2-CPU, has become high in the sequenced list of abnormalscores.

An administrator refers to this result and can learn that abnormalityoccurs in a value of an element of performance information and that iscaused by SV2-CPU.

By the above mentioned Steps S201 to S208, an operations managementapparatus can perform the correlation change analysis step.

In the correlation change analysis step, a value of the second elementis predicted based on the first element of the performance informationacquired newly which has not been used for generation of the correlationmodel and the correlation function, a prediction error by comparing avalue of the second element of the performance information acquirednewly which has not been used for generation of the correlation modelwith the predicted value of the second element is calculated, andwhether the prediction error is in a predetermined error range isanalyzed.

In the correlation change analysis step, when the prediction error isoutside the error range, determination that the correlation between thefirst element and the second element has been destroyed is made, and anabnormal score of the first element and the second element iscalculated.

Further, in the correlation change analysis step, based on the abnormalscore, the elements are presented being sequenced.

According to the first exemplary embodiment, correlation modelgeneration unit generates a correlation model by deriving a transformfunction for time series of values of two elements of performanceinformation when making one element input and making the other output asdiscussed above. When correlation change analysis unit acquires newperformance information which has not been used for generation of acorrelation model, it determines whether the value of each element ofthe performance information conforms with the transform function of agenerated correlation model, and then outputs information including thenumber and the amount of collapsed correlations to a failure analysisunit. Thus, in the present exemplary embodiment, the occurring place ofan abnormality can be identified according to whether a correlationlearned at normal times has collapsed or not.

As a result, compared with threshold monitoring of performanceinformation of related technology, the first exemplary embodiment hasthe effect that it can detect a performance abnormality such as responsedegradation correctly and specify the occurring place of theabnormality.

Also, in comparison with a method of related technology which calculatesa correlation of performance information at the time of an abnormality,the first exemplary embodiment has the effect that it is able toindicate relation when being normal and relation when being abnormaldistinctively.

Further, the first exemplary embodiment can reduce administrator'sburden and prevent increase of an amount of processing of a system,because data for knowledge does not need to be prepared in advance forthese analyses, and thus a processing history or the like besides theperformance information does not need to be collected.

In related technology, because a model is being generated as a timevariation function of one of performance information item, it isdetermined whether the value of the one of performance information itemis same as the value predicted last time.

In contrast, the first exemplary embodiment can determine whetherrelation of the values of two performance information items is kept bygenerating a model as a transform function between the two performanceinformation items.

In related technology, although a correlation rule between twoperformance information items is used, it is not described at all how togenerate this rule, and there is a problem that burdens of rulegeneration to find a singular point is heavy.

Also, in related technology, although a value of a coefficient ofcorrelation is calculated, a transform function between two elements ofperformance information is not calculated. The characteristic of amethod to derive a transform function is different from other analyticalmethods. In related technology, although it can derive to which modelprepared in advance a result of the calculation is similar, a method todecide the contents of a model prepared is unexplained.

In contrast, in the first exemplary embodiment, as shown in FIG. 9, amodel with fewer false reports can be generated by extracting a strongcorrelation. In the first exemplary embodiment, ranking of the degree ofabnormality of each element and an element which is abnormal can beillustrated as shown in FIG. 14 by analyzing from a transform functionof 1 to 1.

Here, by a computer executing various programs stored in a suitablememory, some of blocks in the block diagram shown in FIG. 4 (such asblocks indicated by the symbols 123, 124, 121, 122, 126, 127 and 128,for example) may be a software module which indicates a statefunctionalized by the program.

That is, although the physical composition of the first exemplaryembodiment is of one or more CPUs (or, one or more CPUs and one or morememories) or the like, for example, software structure by each unit(circuit and means) expresses a plurality of functions that CPU exhibitsunder control of a program as a component by a plurality of units(means) respectively.

When a dynamic state where the CPU is operated by a program (a statewhere each procedure configuring the program is being executed) isexpressed functionally, it can be considered that each part (means) isstructured inside the CPU. In a static state where the program is notbeing executed, an entire program for enabling structuring of each means(or each program part included in the structure of each means) arestored in a storage area such as a memory.

It is naturally understood that the explanations of each unit (means)provided above is understood as describing a computer functionalized byprograms along with the functions of the programs, or as describing anapparatus includes a plurality of electronic circuit blocks that arefunctionalized permanently with specific hardware. Therefore, thosefunctional blocks can be achieved in various kinds of forms such as onlywith hardware, only with software, or combination of those, and it isnot intended to be limited to any one of those.

Each unit may be configured as a device including a dedicated computerwhich can communicate, and an operations management system may beconfigured by these devices.

Second Exemplary Embodiment

Next, a second exemplary embodiment will be described based on FIG. 15.In the following description, configuration substantially similar to thefirst exemplary embodiment will be skipped, and only a different part isstated. FIG. 15 is an exemplary block diagram of the entire structure ofan operations management apparatus of the second exemplary embodiment.

The configuration in the second exemplary embodiment includes a changehistory information storage processing unit 218 and a steady changeanalysis unit 231 in addition to the configuration described using FIG.4 of the first exemplary embodiment.

As shown in FIG. 15, operations management apparatus 200 of the secondexemplary embodiment includes change history information storageprocessing unit 218 and steady change analysis unit 231 in addition toservice executor 221, a performance information storage processing unit212, information collection unit 222, analysis setting storageprocessing unit 214, failure analysis unit 226, administrator dialogueunit 227, handle executing unit 228, correlation model generation unit223, correlation model information storage processing unit 216 andcorrelation change analysis unit 224 which are the compositions of thefirst exemplary embodiment.

Change history information storage processing unit 218 accumulateshistory information on a correlation change analyzed by correlationchange analysis unit 224.

Steady change analysis unit 231 reads a history of correlationdestruction from change history information storage processing unit 218,and when finding a correlation destroyed continuously for a certainperiod, disables the corresponding correlation of correlation modelsaccumulated in correlation model information storage processing unit216.

When disabled correlations reach a given proportion, steady changeanalysis unit 231 directs correlation model generation unit 223 tore-generate correlation models.

FIG. 16 is another exemplary block diagram of the entire structure of anoperations management apparatus of the second exemplary embodiment. Asshown in FIG. 16, each unit of operations management apparatus 200 mayinclude a plurality of functions of a control unit.

Steady change analysis unit 231 may analyze whether a correlation of acorrelation model is destroyed steadily.

Above-mentioned steady change analysis unit 231 may disable thecorrelation model, the correlation of which is destroyed steadily.

Steady change analysis unit 231 may direct the correlation modelgeneration unit to re-generate correlation models, when a proportionthat correlation models which have been disabled occupy in allcorrelation models exceeds a predetermined value.

Steady change analysis unit 231 may perform control to indicatenecessity of re-generation of the correlation models, when a proportionthat correlation models which have been disabled occupy in allcorrelation models exceeds a predetermined value.

(Correlation Destruction in Steadiness Analysis)

Here, the outline of correlation destruction in steadiness analysis bysteady change analysis unit 231 will be described with reference to FIG.17. FIG. 17 is an exemplary diagram of correlation model disabling in anoperations management apparatus of the second exemplary embodiment. FIG.17 is an explanation drawing showing an example of the outline ofcorrelation destruction in steadiness analysis of an operationsmanagement apparatus according to the present exemplary embodiment.

As shown in FIG. 17, in correlation graph G321, correlations betweenelement D (SV2-MEM) and element E (SV3-CPU), and element E (SV3-CPU) andelement F (SV3-MEM) are destroyed steadily (it is indicated by a dottedline).

FIG. 18 is an exemplary diagram of a data structure of correlationmodels in an operations management apparatus of the second exemplaryembodiment.

Steady change analysis unit 231 corrects correlation models 116 b shownin FIG. 8 to correlation models 216 b shown in FIG. 18 by changing thefield of “Effective” of correlations between SV3-CPU and SV3-MEM, andSV3-CPU and SV2-MEM to x.

For example, a graph corresponding to these correlation models 216 bwill be graph G322 shown in FIG. 17.

After this, correlation change analysis unit 224 reads these correlationmodels, and prevents detecting these correlation destructions every timeby analyzing only correlations which are not disabled.

(Processing Procedure)

Next, processing of each unit in an operations management apparatusincluding the above-mentioned configurations will be also realizable asa method, and thus various processing procedures as a data processingmethod will be described with reference to FIGS. 19 and 20. FIG. 19 isan exemplary flowchart of the overall processing procedure in anoperations management apparatus of the second exemplary embodiment.

A data processing method of the exemplary embodiment performsinformation processing to acquire performance information for each of aplurality of performance items from a plurality of controlled units andto manage operation of the controlled unit.

This data processing method may include, as basic configuration,obtaining a correlation model for each element pair of performanceinformation by deriving, when the performance items or the controlledunits are designated as an element of the performance information, acorrelation function between a first series of performance informationthat indicates time series variation about a first element and a secondseries of performance information that indicates time series variationabout a second element, and generating the correlation model between thefirst element and the second element based on the correlation function(Step S21 shown in FIG. 19, for example); and analyzing a change in thecorrelation model based on the performance information acquired newlywhich has not been used for generation of the correlation model (StepS22 shown in a FIG. 19, for example).

The data processing method may further include analyzing whether thecorrelation of the correlation model is destroyed steadily (Step S23shown in a FIG. 19, for example).

Here, only detailed processing of steady change analysis will bedescribed below, because detailed processing of the correlation modelgeneration and the correlation change analysis is same as ones describedin the first exemplary embodiment.

(Detailed Processing of Steady Change Analysis)

FIG. 20 is an exemplary flowchart of the detailed processing procedureof the steady change analysis in an operations management apparatus ofthe second exemplary embodiment.

When destruction of a correlation is detected, correlation changeanalysis unit 224 of the present exemplary embodiment accumulates ahistory thereof in change history information storage processing unit218.

As shown in FIG. 20, steady change analysis unit 231 of a computerincluded in an operations management apparatus reads the history of thiscorrelation destruction (Step S301).

Next, steady change analysis unit 231 performs determination processingof whether there is a correlation destroyed steadily (Step S302).

In this determination processing, when being determined that there is nocorrelation destroyed steadily, steady change analysis unit 231 finishesthe processing.

On the other hand, in this determination processing, when beingdetermined that there is a correlation destroyed steadily, steady changeanalysis unit 231 advances towards Step S303.

That is, when there is a correlation being destroyed continuously (StepS302), steady change analysis unit 231 disables the correlation beingdestroyed among correlation models accumulated in correlation modelinformation storage processing unit 216 (Step S303).

FIG. 17 indicates an example of such correlation destruction. As shownin FIG. 17, in correlation graph G321, the correlations between elementD and element E, and element E and element F are destroyed steadily (itis indicated by a dotted line).

Steady change analysis unit 231 corrects correlation models 116 b shownin FIG. 8 to correlation models 216 b shown in FIG. 18 by changing thefield of “Effective” of correlations between SV3-CPU and SV3-MEM, andSV3-CPU and SV2-MEM to x.

As a result, a graph corresponding to these correlation models 216 bwill be graph G322 shown in FIG. 17, for example.

After this, correlation change analysis unit 224 reads these correlationmodels, and prevents detecting these correlation destructions every timeby analyzing only correlations which are not disabled.

Steady change analysis unit 231 further performs determinationprocessing of whether the proportion of the number of correlationsdisabled in this way in the correlation model is beyond a predeterminedvalue decided in advance (Step S304).

In this determination processing, when being determined that the numberof disabled correlations does not exceed the predetermined proportion,steady change analysis unit 231 finishes the processing.

On the other hand, in this determination processing, when beingdetermined that the number of disabled correlations exceeds thepredetermined proportion, steady change analysis unit 231 advancestowards Step S305.

That is, when the number of correlations disabled in this way exceedsthe predetermined proportion in the correlation model (Step S304),steady change analysis unit 231 directs correlation model generationunit 223 to re-generate correlation models (Step S305).

An example of an interactive screen when the number of disabledcorrelation models becomes large is shown in FIG. 21. FIG. 21 is anexemplary diagram of an indicated display screen in an operationsmanagement apparatus of the second exemplary embodiment. An example of adisplay screen displayed on a display unit of an operations managementapparatus is shown in FIG. 21.

As shown in FIG. 21, display screen U200 (model re-generation screen)shown on a display unit includes a model related information displayportion U220 which indicates model related information such as a modelname, date-written, the number of correlations and steady destruction.

Display screen U200 includes display portion U210 which indicates amessage related to a model generation. Display screen U200 includesfirst display operating portion U242 referring to a model. Displayscreen U200 includes second display operating portion U244 generating amodel on a specific re-generation condition. Display screen U200includes third display operating portion U246 ending displaying themodel re-generation screen.

Thus, an administrator can learn that the correlation model which isbeing used for an analysis became unsuitable for the present operationsituation by information from a system.

By the above mentioned Steps S301 to S305, an operations managementapparatus may perform the steady change analysis step. In the steadychange analysis step, the correlation model, the correlation of which isdestroyed steadily, may be disabled.

Further in the steady change analysis step, the correlation modelgeneration unit may be directed to re-generate a correlation model, whena proportion that correlation models which have been disabled occupy inall correlation models exceeds a predetermined value.

In the steady change analysis step, it may be indicated thatre-generation of the correlation model is needed, when a proportion thatcorrelation models which have been disabled occupy in all correlationmodels exceeds a predetermined value.

As mentioned above, according to the second exemplary embodiment, asteady change analysis unit disables an element in the correlationmodels generated once which is destroyed steadily, while exhibiting thesame operation effect as the first exemplary embodiment.

As a result, in the second exemplary embodiment, even when thecharacteristic of a system is changing gradually, it is possible torestrain unnecessary abnormality detection about performanceinformation, and perform correct abnormality detection.

In the second exemplary embodiment, a highly precise analysis can alwaysbe maintained, because necessity to re-generate a correlation model canbe shown to an administrator when there are a lot of disabled elements.

Other structures, other steps, and the operational effects thereof arethe same as those of the case of the first exemplary embodimentdescribed above. Further, the content of operation of each step and thestructural elements of each unit and functions realized by themdescribed above may be put into a program to be executed by a computer.

Other Various Modifications

Although the device and method according to the present invention havebeen described according to specific exemplary embodiments, it ispossible to modify the exemplary embodiments described in various wayswithout departing from the scope of the present invention.

The number, position and shape or the like of the constructionalelements are not limited to the above-mentioned exemplary embodiments,and the number, position and shape or the like which are suitable whenthe present invention is implemented can be selected. For example, inabove-mentioned exemplary embodiment, as a judgment of whether acorrelation at the time of calculation of an abnormal score incorrelation change analysis is being collapsed or not, a case when aprediction error exceeds 20% has been illustrated. However, the presentinvention does not intend to limit these numbers.

Further, there may be a case where the size of correlation destructionis classified into a plurality of stages, without being limited to thecase where correlation destruction is classified into two cases ofexistence or nonexistence of correlation destruction.

The operation control managing software according to the presentinvention may be installed in one PC, or it may be installed in aconfiguration which can be used by a terminal and a server in aclient/server system or in P2P environment. Further, the various displayscreens may have a configuration accessible on the web.

(Program)

Further, the software program of the present invention for enabling thefunctions of the exemplary embodiments described above includes: eachprocessing program executed in a program such as a program thatcorresponds to the processing units (processing means), functions andthe like shown in the various block diagrams of each of theabove-described exemplary embodiments and a program that corresponds tothe processing procedures, the processing means, the functions and thelike shown in the flowcharts and the like; and the whole part or a partof the method (steps), the described processing, and the data describedall through the present specification.

Specifically, an operations management program of each exemplaryembodiment can cause a computer provided in an operations managementapparatus which acquires performance information for each of a pluralityof performance items from a plurality of controlled units and managesoperation of the controlled unit to realize various functions.

This operations management program can cause a computer to realize amethod including: obtaining a correlation model for each element pair ofperformance information by deriving, when the performance items or thecontrolled units are designated as an element of the performanceinformation, a correlation function between a first series ofperformance information that indicates time series variation about afirst element and a second series of performance information thatindicates time series variation about a second element, and generatingthe correlation model between the first element and the second elementbased on the correlation function (the composition of symbol 124 shownin FIG. 4 and the function of Step S12 shown in FIG. 11, for example);and analyzing a change in the correlation model based on the performanceinformation acquired newly which has not been used for generation of thecorrelation model (the composition of symbol 123 shown in FIG. 4 and thefunction of Step S11 shown in FIG. 11, for example).

This operations management program may, in the analysis of a change inthe correlation model, calculate a predicted value of the second elementbased on the first element of the performance information acquired newlywhich has not been used for generation of the correlation model and thecorrelation function, calculate a prediction error by comparing a valueof the second element of the performance information acquired newlywhich has not been used for generation of the correlation model with thepredicted value of the second element, and analyzes whether theprediction error is in a predetermined error range.

The operations management program also may, in the analysis of a changein the correlation model, when the prediction error is outside the errorrange, determine that a correlation between the first element and thesecond element has been destroyed, and calculate an abnormal score ofthe first element and the second element.

The operations management program further may, in the analysis of achange in the correlation model, based on the abnormal score, control sothat each of the elements is presented being sequenced.

The operations management program may analyze whether the correlation ofthe correlation model is destroyed steadily.

The operations management program may, in the analysis of whether thecorrelation of the correlation model is destroyed steadily, disable thecorrelation model, the correlation of which is destroyed steadily.

The operations management program may, in the analysis of whether thecorrelation of the correlation model is destroyed steadily, direct thecorrelation model generation unit to re-generate the correlation model,when a proportion that correlation models which have been disabledoccupy in all correlation models exceeds a predetermined value.

The operations management program may, in the analysis of whether thecorrelation of the correlation model is destroyed steadily, performcontrol to indicate that re-generation of the correlation model isneeded, when a proportion that the correlation models which have beendisabled occupy in all correlation models exceeds a predetermined value.

Further, the program described above may be of any forms such as anobject code, a program executed by an interpreter, script data to besupplied to OS, and the like. The program can be implemented ashigh-standard procedure-type or object-oriented programming language, oras assembly or machine language according to need. In any case, thelanguage may be of a compiler type or an interpreter type. The programincorporated in application software that can be operated in an ordinalpersonal computer, a portable information terminal, or the like, is alsoincluded.

As for a method for supplying the program, it is possible to provide theprogram from external equipment communicatively coupled to a computer byan electric communication line (wired or radio line) through theelectric communication line.

For example, it is possible to provide the program by connecting to aweb page of the internet using a browser of a computer and downloadingfrom the web page the program itself or a file which is compressedincluding the automatic installation function to a recording medium suchas a hard disk.

Further, it is also possible by dividing program codes configuring theprogram into a plurality of files, and downloading each of the filesfrom different web pages.

In other words, a server which allows program files for realizingfunctional processing of the present invention on a computer to bedownloaded to a plurality of users is also included in the scope of thepresent invention.

According to a program of the present invention, it is possible toachieve the above-described apparatus according to the present inventionrelatively easily by loading the program from a storage medium such asROM that stores the control program to a computer (CPU) and having itexecuted by the computer, or by downloading the program to a computervia a communication unit and having it executed by the computer. Whenthe spirit of the present invention is embodied as software ofapparatus, the present invention naturally exists in a storage medium onwhich the software is stored and used.

There is no question that the program is all the same regardless of thereproduction stages thereof (whether the program is of a primaryrecorded program or secondarily recorded program). In case where theprogram is supplied by utilizing a communication line, the presentinvention is made use of by using the communication line as atransmission medium. Needless to say, the present invention can bespecified as an invention of a program. Furthermore, dependent claimsregarding the apparatus may be configured such that they correspond todependent claims of the method and the program.

(Information Recording Medium)

Further, the program may be recorded in an information recording medium.An application program containing the program is stored in aninformation recording medium, and it is possible for a computer to readout the application program from the information recording medium andinstall the application program to a hard disk. With this, the programcan be provided by being recorded in an information recording mediumsuch as a magnetic recording medium, an optical recording medium, a ROM,or the like. Using such program-recorded information recording medium ina computer realizes to configure a convenient information processor.

As an information recording media for supplying the program, it ispossible to use a semiconductor memory such as a ROM, a RAM, a flashmemory, or a SRAM and an integrated circuit, an USB memory or a memorycard including such, an optical disk, a magneto-optical disk, a magneticrecording medium, or the like. Further, the program may be recorded on amovable medium such as a flexible disk, a CD-ROM, a CD-R, a CD-RW, anFD, a DVD ROM, an HD DVD (HD DVD-R-SL: single layer, an HD DVD-R-DL:double layer, an HD DVD-RW-SL, an HD DVD-RW-DL, an HD DVD-RAM-SL), aDVD+/−R-SL, a DVD+/−R-DL, a DVD+/−RW-SL, a DVD+/−RW-DL, a DVD-RAM, aBlu-Ray Disk (Registered Trademark): a BD-R-SL, a BD-R-DL, a BD-RE-SL, aBD-RE-DL), an MO, a ZIP, a magnetic card, a magnetic tape, an SD card, amemory stick, a nonvolatile memory card, an IC Card, or may be recordedon a storage device such as a hard disk that is built-in on a computersystem.

Further, the information recording medium is to include a medium such asa communication line which is used when transmitting the program via thecommunication line such as a network of the Internet or a telephonecircuit or the like that kinetically holds the program for a short time(transmission medium or a carrier wave), and to include a medium thatholds the program for a specific length of time, such as a volatilememory provided inside a computer system to be a server or a client ofthe above-described case.

Furthermore, in a case where an OS operated on a computer or an RTOS orthe like on a terminal (for example, a mobile telephone) executes a partof or the whole processing, it is also possible to achieve the samefunctions and obtain the same effects as those of the exemplaryembodiments described above.

Further, it is also possible to distribute a recording medium such as aCD-ROM in which the program is coded and stored to a user; let the userwho satisfies a prescribed condition download key information fordecoding the codes from a web page via the internet; and execute thecoded program by using the key information to have the program installedto a computer. In this case, the structures of the present invention mayinclude each structural element of the program (various means, steps,and data) and a coding means for coding the program (various means,steps, and data).

Furthermore, although the system according to the exemplary embodimentshas been described as a client server system above, it may be a systemby Peer-to-Peer communication where terminals configure a network andtransmit/receive data each other without a server.

In that case, a manager may be a master terminal in a peer-to-peermethod.

Also, there is no problem to integrate a system according to theabove-described exemplary embodiments and other information processingsystems to configure the whole of the systems as a system according tothe present invention. This information processing system is to includeOS and hardware such as peripheral equipment.

A system in the exemplary embodiment refers to one in which a pluralityof apparatuses are assembled logically, and whether the apparatuses ofeach configuration are in the same chassis or not is not a question. Forthis reason, the present invention may be applied to a system includinga plurality of equipment, and it may also be applied to an apparatusincluding one device. OS and hardware such as a peripheral device may beincluded in a system

Further, as for the information processor on which the above-describedprogram and the like are loaded, a server is not limited to a personalcomputer, but various servers, EWS (engineering work station), amedium-sized computer, a mainframe, or the like may be used. In additionto the above examples, an information terminal may be so structured thatit can be utilized through a portable information terminal, variousmobile terminals, a PDA, a portable telephone, a wearable informationterminal, various kinds of (portable, for example) televisions, a DVDrecorder, various kinds of audio equipment, a household appliance towhich various information communication functions are incorporated, agame machine having a network function, etc. Alternatively, one which ismodified as an application displayed on these terminals can also beincluded in the scope of the present invention.

Further, the above-described program may be a program that achieves apart of the functions described above, or may be a so-called differencefile (difference program) which can achieve the above-describedfunctions in combination with a program that has already been stored inthe computer system.

Furthermore, the steps shown in the flowcharts of the presentspecification include not only the processing executed in a time seriesmanner according to the depicted procedures but also the processing thatis not necessarily executed in a time series manner but executed inparallel or individually. Regarding the actual implementation, the orderof the program procedures (steps) can be altered. Further, depending onneeds of an implementation, a specific procedure (step) described in thecurrent specification can be implemented, eliminated, added, orrearranged as a combined procedure (step).

Further, the functions of the program such as each means and eachfunction of the apparatus, and the functions of the procedures of eachstep may be achieved by dedicated hardware (a dedicated semiconductorcircuit, for example), and a part of the whole functions of the programmay be processed by the hardware, and the other functions may beprocessed by software. In a case of using the dedicated hardware, eachunit may be formed by an integrated circuit such as an LSI. These unitsmay be formed on a single chip individually, or a part or the entireunits may be formed on a single chip. Further, the LSI may be providedwith another functional block such as a streaming engine. Furthermore,the method for forming integrated circuit may not necessarily be limitedto an LSI, and a dedicated circuit or a general-purpose processor may beemployed. Moreover, if there is introduced a technique for achievingcircuit integration in place of a LSI due to improvements in thesemiconductor technique or other techniques derived therefrom, thattechniques can naturally be used to integrate the functional blocks.

Further, “communication” may be radio communication, wiredcommunication, or communication achieved by employing both the radiocommunication and the wired communication (i.e., communication isachieved by employing the radio communication in a certain section andby employing the wired communication in another section). In addition,“communication” may be achieved by employing the wired communicationfrom a certain device to another device and employing the radiocommunication from another device to still another device.

Further, “communication” includes a communications net. As a networkconfiguring the communications net, any of hardware structures can beemployed, e.g., various circuit nets such as a portable telephonecircuit net (including a base station and a switching system), a publictelephone circuit net, an IP telephone net, an ISDN circuit net, or anet similar to those, the Internet (i.e., a communication mode usingTCP/IP protocol), the Intranet, LAN (including Ethernet (RegisteredTrademark) and gigabit Ethernet (Registered Trademark)), WAN, an opticalfiber communications net, a power-line communications net, variousdedicated circuit net capable of handling broadband, etc. Further, thenetwork may employ any kinds of protocols, and it may be a network usingTCP/IP protocol, a network using any kinds of communication protocolsother than the TCP/IP protocol, a virtual network built in asoftware-oriented manner, or a network similar to those. Furthermore,the network is not limited only to a wired network but may also be aradio (including a satellite communication, various high-frequencycommunication means, or the like) network (for example, a networkincluding a single carrier communication system such as a handy phonesystem or a portable telephone, a spread spectrum communication systemsuch as W-CDMA or a radio LAN conforming to IEEE802.11b, a multicarriercommunication system such as IEEE802.11a or Hiper LAN/2) andcombinations of those may be used, and a system connected to anothernetwork may also be employed. Further, the network may be of any formsuch as point-to-point, point-to-multipoints,multipoints-to-multipoints, etc.

Further, in a communication structure between an operations managementapparatus and controlled units, an interface formed in one of or bothsides of them may be of any types such as a parallel interface, a USBinterface, IEEE1394, a network such as LAN or WAN, a type similar tothose, or any interface that may be developed in the future.

Furthermore, the way to generate correlation model, and to performcorrelation change analysis does not need to be limited only to asubstantial device, it is easily understood that the present inventionmay function as a method thereof. Accordingly, the present inventionregarding a method is not limited only to a substantial device but mayalso be effective as a method thereof. In this case, an operationsmanagement apparatus and an operations management system may be includedas examples for realizing the method.

Such an operations management system may be used alone or may be usedwhile being mounted to an apparatus, for example, and thus the technicalspirit of the present invention is not limited only to such cases butmay also include various forms. Therefore, the present invention may beapplied to software or hardware, and the forms thereof may change asneeded. When the technical spirit of the present invention is embodiedas software of an apparatus, the present invention naturally exists on arecording medium on which the software is recorded and is utilized.

Further, a part of the present invention may be achieved by software andthe other part thereof may be achieved by hardware, or a part thereofmay be stored on a recording medium to be read accordingly and asneeded. When the present invention is achieved by software, it may bestructured to use hardware and an operating system, or may be achievedseparately from those.

It is supposed that the scope of the invention is not limited to theexamples of illustration.

Furthermore, various stages are included in each of the above-describedexemplary embodiments, and it is possible to extract various inventionstherefrom by combining a plurality of structural elements disclosedtherein. That is, the present invention includes various combinations ofeach of the exemplary embodiments as well as combinations of any one ofthe exemplary embodiments and any one of modifications examples thereof.In such cases, operational effects obvious from each structure disclosedin each of the exemplary embodiments and the modifications examplesthereof are to be included in the operational effects of an exemplaryembodiment, even if there are no specific depictions of those in theexemplary embodiment. Inversely, all the structures that provideoperational effect depicted in the exemplary embodiments are notnecessarily the essential structural elements of the substantial featurepart of the present invention. Moreover, an exemplary embodimentconfigured by omitting some structural elements from the entirestructural elements disclosed in the exemplary embodiments, and thetechnical range based upon the structure thereof may also be taken asthe invention.

Each of the exemplary embodiments and the modification examples thereofare merely presented as examples out of variety of embodiments of thepresent invention for helping the present invention to be understoodeasily. That is, they are just showing examples when putting the presentinvention into effect, are illustrative, are not intended to limit thescope of the present invention, and various modifications and/or changescan be applied as needed. It is to be understood that the presentinvention can be embodied in various forms based upon the technicalspirit and the main features thereof, and the scope of the technicalspirit of the present invention is not to be limited by the exemplaryembodiments and the modification examples thereof.

Accordingly, it is to be understood that each of the elements disclosedabove is to include all the design changes and the equivalent thereofwithin the scope of the technical spirit of the present invention.

In an operations management apparatus of related technology, there arefollowing problems.

That is, in an operations management apparatus of related technology,when a threshold value is set low, in a case such as where a fluctuationof performance information is large, there is a problem that a falsereport occurs frequently, and an administrator is confused. When thethreshold value is set highly, there is a problem that failures exceptfor serious ones cannot be detected any more, and thus detection ofperformance abnormality such as a case where the operating responsespeed degrades although a system is still operating is difficult.

Further, although the abnormal value of each element of performanceinformation can be detected, there is a problem that abnormality causedby relation with a value of another element of performance informationwhich has relation of input/output such as a bottleneck cannot bedetected.

Thus, in threshold value monitoring of performance information inrelated technology, there is a problem that it cannot detect performanceabnormality such as response degradation correctly, and thatconsequently it cannot specify the occurring place of the abnormality.

In a method to calculate a correlation of performance information at thetime of abnormality, there is a problem that it is difficult todetermine whether the correlation is generated only at the time ofabnormality or whether it exists at normal times also.

In Japanese Patent Application Laid-Open No. 2006-024017, an operationsmanagement apparatus has to collect the history of all processing whichcan be related and analyze it in order to predict a correct load. When asystem is magnified or when it cooperates with other systems, there is aproblem that relation between processing and a load becomes verycomplicated, a load of data collection and an analysis is large, andthus high knowledge for analyzing that is needed.

In Japanese Patent Application Laid-Open No. 2002-342182, because itsimply shows relation between performance information items at the timewhen a failures occurs, there is a problem that an administrator has toverify which actually is the cause among a plurality of elements ofperformance information which can have causality with a certainabnormality.

There is also a problem that it is difficult to determine whether thecorrelation is generated only the time of abnormality or whether itexists at normal times also.

In Japanese Patent Application Laid-Open No. 2006-146668, a correlationcoefficient between obtained operation information items is a value, andfrom correlation of values at some point of time (the time ofabnormality), the associated cause of the abnormality can be shown.However, because correlation of future values that do not exist cannotbe calculated, there is a problem that an administrator has to verifywhich actually is the cause among a plurality of elements of performanceinformation which can have causality with a certain abnormality. InJapanese Patent Application Laid-Open No. 2006-146668, there is aproblem that a sign of a failure cannot be detected.

In Japanese Patent Application Laid-Open No. 2007-207117, a function ofeach performance information item is presumed. Then, in the formula ofy=f(x), x expresses a time change of one y. An operations managementapparatus prepares two such formulas, and the relation between the twois determined by a correlation rule given separately. Because a rule isnot generated automatically, when not giving a rule between allperformance information elements of a system separately, there is aproblem that the operations management apparatus cannot predictcorrectly which actually is the cause among a plurality of elements ofperformance information which can have causality with a certainabnormality.

That is, because correlation between the CPU utilization rate and thethroughput is a correlation only between an element and another element,and as a result, an administrator has to verify which actually is thecause among a plurality of elements of performance information which canhave causality with a certain abnormality.

In a Published Japanese translation of PCT application No. 2005-524886bulletin, a correlation model is not used, although a conversion of aworkload and metrics is performed. Accordingly, there is a problem thatan administrator has to verify which actually is the cause among aplurality of elements of performance information which can havecausality with a certain abnormality, and thus the administrator has toinput everything of these conversion methods by handwork.

According to the present invention, a correlation model generation unitgenerates a correlation model by deriving a correlation function fortime series information of two elements of performance information (aseries of performance information). When new performance informationwhich has not been used for generation of a correlation model isacquired, the correlation change analysis unit analyzes whether theperformance information acquired newly is performance informationconforming to the correlation function of a correlation model which hasbeen already generated, that is, whether there is a change or not in thecorrelation in the correlation model (whether the correlation is kept orcollapsed).

An exemplary advantage according to the invention is that it can providean operations management apparatus, an operations management system, adata processing method and an operations management program which can:specify the occurring place of an abnormality (an element withabnormality) according to whether a correlation generated at the time ofnormal operation is deformed or not; and detect performance abnormalitysuch as response degradation and a sign of a failure correctly andspecify an occurring place by modeling a correlation of detectedperformance information, and monitoring a change of the model.

The previous description of embodiments is provided to enable a personskilled in the art to make and use the present invention. Moreover,various modifications to these embodiments will be readily apparent tothose skilled in the art, and the generic principles and specificexamples defined herein may be applied to other embodiments without theuse of inventive faculty. Therefore, the present invention is notintended to be limited to the embodiments described herein but is to beaccorded the widest scope as defined by the limitations of the claimsand equivalents.

Further, it is noted that the inventor's intent is to retain allequivalents of the claimed invention even if the claims are amendedduring prosecution.

1. An operations management apparatus which acquires performanceinformation for each of a plurality of performance items from aplurality of controlled units and manages operation of the controlledunits, comprising: a correlation model generation unit which derives,when the performance items or the controlled units are designated as anelement of performance information, a correlation function between afirst series of performance information that indicates time seriesvariation about a first element and a second series of performanceinformation that indicates time series variation about a second element,generates a correlation model between the first element and the secondelement based on the correlation function, and obtains the correlationmodel for each element pair of the performance information; and acorrelation change analysis unit which analyzes a change in thecorrelation model based on the performance information acquired newlywhich has not been used for generation of the correlation model.
 2. Theoperations management apparatus according to claim 1, wherein thecorrelation change analysis unit calculates a predicted value of thesecond element based on the first element of the performance informationacquired newly which has not been used for generation of the correlationmodel and the correlation function, calculates a prediction error bycomparing a value of the second element of the performance informationacquired newly which has not been used for generation of the correlationmodel with the predicted value of the second element, and analyzeswhether the prediction error is in a predetermined error range.
 3. Theoperations management apparatus according to claim 2, wherein thecorrelation change analysis unit determines that a correlation betweenthe first element and the second element has been destroyed when theprediction error is out of the error range, and calculates an abnormalscore of the first element and the second element.
 4. The operationsmanagement apparatus according to claim 3, wherein the correlationchange analysis unit performs control to present each of the elementbeing sequenced based on the abnormal score.
 5. The operationsmanagement apparatus according to claim 3 further comprising: a steadychange analysis unit which analyzes whether the correlation of thecorrelation model is destroyed steadily.
 6. The operations managementapparatus according to claim 5, wherein the steady change analysis unitdisables the correlation model, the correlation of which is destroyedsteadily.
 7. The operations management apparatus according to claim 6,wherein the steady change analysis unit directs the correlation modelgeneration unit to re-generate the correlation model, when a proportionthat the correlation model which has been disabled occupies in allcorrelation models exceeds a predetermined value.
 8. The operationsmanagement apparatus according to claim 6, wherein the steady changeanalysis unit performs control to indicate that re-generation of thecorrelation model is needed, when a proportion that the correlationmodel which has been disabled occupies in all correlation models exceedsa predetermined value.
 9. The operations management system, comprising:a plurality of controlled units; and an operations management apparatuswhich acquires performance information for each of a plurality ofperformance items from the plurality of controlled units and managesoperation of the controlled units, wherein the operations managementapparatus including: a correlation model generation unit which derives,when the performance items or the controlled units are designated as anelement of performance information, a correlation function between afirst series of performance information that indicates time seriesvariation about a first element and a second series of performanceinformation that indicates time series variation about a second element,generates a correlation model between the first element and the secondelement based on the correlation function, and obtains the correlationmodel for each element pair of the performance information; and acorrelation change analysis unit which analyzes a change in thecorrelation model based on the performance information acquired newlywhich has not been used for generation of the correlation model.
 10. Adata processing method of an operations management apparatus whichacquires performance information for each of a plurality of performanceitems from a plurality of controlled units and manages operation of thecontrolled units, comprising: obtaining a correlation model for eachelement pair of performance information by deriving, when theperformance items or the controlled units are designated as an elementof the performance information, a correlation function between a firstseries of performance information that indicates time series variationabout a first element and a second series of performance informationthat indicates time series variation about a second element, andgenerating the correlation model between the first element and thesecond element based on the correlation function; and analyzing a changein the correlation model based on the performance information acquirednewly which has not been used for generation of the correlation model.11. The data processing method according to claim 10, wherein theanalyzing of a change in the correlation model calculates a predictedvalue of the second element based on the first element of theperformance information acquired newly which has not been used forgeneration of the correlation model and the correlation function,calculates a prediction error by comparing a value of the second elementof the performance information acquired newly which has not been usedfor generation of the correlation model with the predicted value of thesecond element, and analyzes whether the prediction error is in apredetermined error range.
 12. The data processing method according toclaim 11, wherein the analyzing of a change in the correlation modeldetermines that a correlation between the first element and the secondelement has been destroyed when the prediction error is outside theerror range, and calculates an abnormal score of the first element andthe second element.
 13. The data processing method according to claim12, wherein the analyzing of a change in the correlation model performscontrol to present each of the element being sequenced based on theabnormal score.
 14. The data processing method according to claim 12,further comprising: analyzing whether the correlation of the correlationmodel is destroyed steadily.
 15. The data processing method according toclaim 14, wherein the analyzing whether the correlation of thecorrelation model is destroyed steadily disables the correlation model,the correlation of which is destroyed steadily.
 16. The data processingmethod according to claim 15, wherein the analyzing whether thecorrelation of the correlation model is destroyed steadily directsre-generation of the correlation model, when a proportion that thecorrelation model which has been disabled occupies in all correlationmodels exceeds a predetermined value.
 17. The data processing methodaccording to claim 15, wherein the analyzing whether the correlation ofthe correlation model is destroyed steadily performs control to indicatethat re-generation of the correlation model is needed, when a proportionthat the correlation model which has been disabled occupies in allcorrelation models exceeds a predetermined value.
 18. A non-transitorycomputer readable storage medium storing a computer program, the programcausing an operations management apparatus which acquires performanceinformation for each of a plurality of performance items from aplurality of controlled units and manages operation of the controlledunits to perform a method, the method comprising: obtaining acorrelation model for each element pair of performance information byderiving, when the performance items or the controlled units aredesignated as an element of the performance information, a correlationfunction between a first series of performance information thatindicates time series variation about a first element and a secondseries of performance information that indicates time series variationabout a second element, and generating the correlation model between thefirst element and the second element based on the correlation function;and analyzing a change in the correlation model based on the performanceinformation acquired newly which has not been used for generation of thecorrelation model.
 19. The non-transitory computer readable storagemedium according to claim 18, wherein the analyzing of a change in thecorrelation model calculates a predicted value of the second elementbased on the first element of the performance information acquired newlywhich has not been used for generation of the correlation model and thecorrelation function, calculates a prediction error by comparing a valueof the second element of the performance information acquired newlywhich has not been used for generation of the correlation model with thepredicted value of the second element, and analyzes whether theprediction error is in a predetermined error range.
 20. Thenon-transitory computer readable storage medium according to claim 19,wherein the analyzing of a change in the correlation model determinesthat a correlation between the first element and the second element hasbeen destroyed when the prediction error is outside the error range, andcalculates an abnormal score of the first element and the secondelement.
 21. The non-transitory computer readable storage mediumaccording to claim 20, wherein the analyzing of a change in thecorrelation model performs control to present each of the element beingsequenced based on the abnormal score.
 22. The non-transitory computerreadable storage medium according to claim 20, the method furthercomprising: analyzing whether the correlation of the correlation modelis destroyed steadily.
 23. The non-transitory computer readable storagemedium according to claim 22, wherein the analyzing whether thecorrelation of the correlation model is destroyed steadily disables thecorrelation model, the correlation of which is destroyed steadily. 24.The non-transitory computer readable storage medium according to claim23, wherein the analyzing whether the correlation of the correlationmodel is destroyed steadily directs re-generation of the correlationmodel, when a proportion that the correlation model which has beendisabled occupies in all correlation models exceeds a predeterminedvalue.
 25. The non-transitory computer readable storage medium accordingto claim 23, wherein the analyzing whether the correlation of thecorrelation model is destroyed steadily performs control to indicatethat re-generation of the correlation model is needed, when a proportionthat the correlation model which has been disabled occupies in allcorrelation models exceeds a predetermined value.
 26. An operationsmanagement apparatus which acquires performance information for each ofa plurality of performance items from a plurality of controlled unitsand manages operation of the controlled units, comprising: a correlationmodel generation means for deriving, when the performance items or thecontrolled units are designated as an element of performanceinformation, a correlation function between a first series ofperformance information that indicates time series variation about afirst element and a second series of performance information thatindicates time series variation about a second element, generating acorrelation model between the first element and the second element basedon the correlation function, and obtaining the correlation model foreach element pair of the performance information; and a correlationchange analysis means for analyzing a change in the correlation modelbased on the performance information acquired newly which has not beenused for generation of the correlation model.
 27. A data processingmethod of an operations management apparatus which acquires performanceinformation for each of a plurality of performance items from aplurality of controlled units and manages operation of the controlledunits, comprising: a step for obtaining a correlation model for eachelement pair of performance information by deriving, when theperformance items or the controlled units are designated as an elementof the performance information, a correlation function between a firstseries of performance information that indicates time series variationabout a first element and a second series of performance informationthat indicates time series variation about a second element, andgenerating the correlation model between the first element and thesecond element based on the correlation function; and a step foranalyzing a change in the correlation model based on the performanceinformation acquired newly which has not been used for generation of thecorrelation model.